3 ms·
The point still stands. If open source code is vital to your business you should probably at the very least audit it.
by c22 8y ago
The point still stands. If open source code is vital to your business you should probably at the very least audit it.
- mp3k 8y agoGood advice. Funny thing is, from May I'm working on a big project, where we use ant extensively. We pushed the limits of almost all the available components, found several issues, enhanced it in our custom wrappers. In that time, I was going through the sources of components several times, not only of the ant itself but also through sources of react-components on which the ant is built. YET I HAVEN'T EVER INSPECTED THE BUTTON COMPONENT. Would be super funny if I would have found that christmas egg this summer... Now as I'm thinking about it, we have EnhancedButton, which gets 'block' boolean prop to make it full-width. I was used to that from react-bootstrap and even had the idea to open feature request on antd... In that case I would certainly open the button.tsx... Anyway, great episode in the frontend world.
- aaron695 8y agoDo you audit Linux if you use it? Why only audit open source? Part of the whole reason of open source is trust. At what point does an audit cost more than doing it yourself? Then do you need to audit the audit since you have no trust? Can't we not pass the buck in a just world situation and blame the user and instead encourage open source not to mess with the codebase.